we'd want those escaped though (otherwise I could just inject html)